This method converts the HTML, so it should escape nasty HTML tags.

Also add missing escaping when inserting the base